ERR_CERT_AUTHORITY_INVALID? Check Who Issued the Certificate

ERR_CERT_AUTHORITY_INVALID means Chrome cannot trust the issuer of the website’s certificate. Keep the privacy warning in place and do not sign in, pay or enter personal information. Compare the same public page on another updated device and a trusted network to narrow down whether the website or your connection needs attention.

The message does not automatically mean the website is malicious. A site can install an incomplete certificate chain, a local device can have an outdated trust store, or a work network can inspect secure traffic incorrectly. The warning still matters because Chrome cannot verify the identity presented to it.

Same laptop opens a website in one browser while another browser follows a blocked local path — Illustration of comparing browser paths, not a screenshot of an actual certificate warning.

What ERR_CERT_AUTHORITY_INVALID means

HTTPS, the secure connection used by a website, relies on certificates that link back to a trusted issuer. DigiCert’s certificate-chain explanation describes the intermediate certificates between a website’s certificate and a trusted root. A missing intermediate can stop some clients trusting the site.

Possible reasons include a missing intermediate certificate, a self-signed certificate, an old operating system, or a proxy that replaces the site’s certificate. Google’s current Chrome certificate-error guidance groups this code with the browser’s connection privacy warnings.

The Chrome Root Program’s introduction explains that Chrome checks recognized issuers and other security properties. Trust can also involve local settings. Do not add a certificate yourself just to make the warning disappear.

Check the address before troubleshooting

Read the full domain and look for misspellings.
Type a known official address instead of following a message link.
Check whether the error affects the main site or only one subdomain.
Do not use a lookalike address suggested by the warning page.

If the address came from an email, text message, QR code, or shortened link, find the organization’s home page through a bookmark or another source you trust. A correct certificate on the wrong domain does not make that domain safe.

See whether one site or many sites fail

Open two familiar HTTPS websites in new tabs. If those work and only one correct domain shows NET::ERR_CERT_AUTHORITY_INVALID, the affected website may be sending a certificate chain that Chrome cannot validate. Try the same address in another current browser and on another updated device.

If one site fails across updated devices and unrelated trusted networks, the operator is the next useful contact. That comparison points toward the website, but it is not a complete certificate diagnosis. Send the public URL, error code, time and time zone, with a screenshot that hides personal information. Remove private tokens or account details from any URL you share.

Compare another device on the same WiFi

If another updated device opens the same page on the same WiFi, focus on the original computer or phone. Confirm that its date, time, and time zone are correct, then install supported operating-system and browser updates.

An old trust store may not recognize a current certificate chain. Do not solve that by moving to an older browser that offers a weaker warning. If the device no longer receives security updates, use a supported device for sensitive sites.

An incorrect clock is worth correcting, but Chrome normally identifies time-related certificate trouble with ERR_CERT_DATE_INVALID. Do not assume that changing the time will repair an untrusted issuer.

Try an Incognito window for one comparison

On a computer, use Chrome’s menu to open a New Incognito window and try the same public address. If it works there, note which extensions or saved site data differ in the normal session. Review updates and official support for those tools rather than turning off security or managed filtering.

Google’s Incognito explanation describes a separate browsing session, not invisibility or a security repair. A successful private-window comparison does not prove the site is safe or rule out a network problem.

Compare home WiFi with a trusted hotspot

Try the same public page through a trusted phone hotspot, if your plan allows tethering, or another trusted connection. If the warning disappears, investigate the first network’s portal, proxy or filtering service. A different result is a clue, not proof of interception or a guarantee that the second connection is safe.

This result does not mean the WiFi radio is weak. Your device may have an excellent wireless signal while a service between the router and website changes the secure connection.

Complete a guest-network sign-in safely

Hotels, cafes, airports, apartments, and guest networks may require a portal sign-in before normal browsing. Google’s connection troubleshooting steps recommend signing in to the WiFi portal when a privacy error appears on a public network.

Confirm the network name with the venue. Use its official prompt and never enter a bank, email, or work password into a page that appeared after a certificate warning. If the portal will not open, forget the network and reconnect or ask the venue for its current instructions.

Review VPN, proxy, antivirus, and filtering tools

Some security tools inspect HTTPS by creating a local certificate chain. If their trusted certificate is missing, expired, or installed incorrectly, Chrome may reject the issuer. A VPN or parental-control product can create a similar pattern when only one device is affected.

Keep antivirus, firewall and HTTPS protections enabled. Check for official updates, recent configuration changes and vendor support guidance. On a managed device, ask IT to repair the trusted configuration. Microsoft’s firewall guidance warns that turning off the firewall makes a device more vulnerable; it does not repair a certificate chain.

Leave managed computers to the administrator

School and work devices may use an approved proxy that inspects secure connections. Chrome can show this error when the organization’s certificate or policy is not installed correctly. Send the administrator the error, URL, time, and whether it happens on and off the managed network.

Do not remove managed software, import a certificate from a chat message, or bypass the organization’s controls. The administrator needs to repair the trusted configuration without weakening the device.

Understand local router and NAS warnings

A router, NAS, printer or camera administration page may use a self-signed certificate that Chrome does not trust. A certificate issued for another hostname creates a separate name-mismatch problem. If Chrome shows ERR_CERT_COMMON_NAME_INVALID instead, use the certificate domain-mismatch checklist. A private numeric address alone does not explain which certificate check failed.

Use the manufacturer’s current app, hostname, or local access method. Apply supported firmware through its documented interface. Do not download a random root certificate, expose the administration page to the internet, or assume every certificate on a private address is safe.

Treat errors on many familiar sites as urgent

If several well-known HTTPS sites suddenly show the same unknown issuer, stop entering information. Disconnect from an unfamiliar network and try a trusted connection. Check which VPN, antivirus, filtering, parental-control, or workplace software was installed or updated recently.

If every device on the home network sees the problem but the same sites work on mobile data, contact the provider of the router filter or internet service. If one managed computer sees it on every network, contact its administrator.

Skip fixes that hide the warning

Do not continue to a login, payment, or account-recovery page.
Do not install a certificate from an unknown download.
Do not replace HTTPS with HTTP for a sensitive service.
Do not disable certificate checks or browser protection.
Do not edit the hosts file or copy a random DNS address.
Do not factory-reset the router for a one-site certificate error.

Clearing all cookies and cached images is also a poor first step. It can sign you out, but it does not make an untrusted issuer trusted. Keep each test tied to the pattern you observed.

When the website owner must repair the certificate

Ask the website operator to investigate when the correct public URL fails on current browsers, updated devices and separate trusted networks. Their checks can include missing intermediate certificates, host configuration, renewal and certificate delivery through a proxy or content network. Visitors should not try server commands or install the operator’s certificates.

Visitors cannot repair a public website’s trust chain from Chrome. A responsible operator should not ask customers to ignore the warning or install an unfamiliar certificate.

Match the next step to the pattern

Observed pattern	Next useful step
One correct public site fails on updated devices and trusted networks	Contact the website operator with the code and public address.
Only one device fails	Install supported updates and review official support for its security tools.
Only one network fails	Check its official sign-in portal or ask the network administrator.
Many familiar sites show an unfamiliar issuer	Stop entering information and investigate the connection and recent software changes.
Only a local device’s administration page fails	Use the manufacturer’s documented secure access method.

If the problem stays with one computer, continue with the one-device WiFi checklist. If all home devices lose normal access, use the WiFi or internet outage comparison. Keep Chrome’s privacy warning in place until the certificate chain can be trusted.